Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2024-4412

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Identity Server Wso2 Api Manager Wso2 Carbon Identity Application Authentication Framework and 9 more
CVE-2025-15039

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution of authentication steps. Successful exploitation allows a malicious actor to gain unauthorized access to a targeted user account. This vulnerability can only be exploited when all of the following conditions are met: the application login flow contains a specific secondary authenticator, the Conditional Authentication script is configured with particular event callbacks and re-executes an authentication step, the targeted user has one of the impacted authenticators enrolled, and the attacker successfully completes any preceding authentication steps.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Carbon Identity Application Authentication Framework and 17 more
CVE-2025-13909

Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable information. Successful exploitation allows an attacker to disclose personally identifiable information of users in different tenants, resulting in privacy violations and potential regulatory non-compliance. This may include unauthorized access to user details such as mobile numbers.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Carbon Identity Application Authentication Framework Email Otp Authenticator Identity Server and 4 more